Privacy Policy

Last updated: 09/11/2026

1. Data Controller

This Privacy Policy explains how personal data is processed when you visit www.mockup.es or contact me.

For information about the cookies and storage used by the website, see the Cookie Policy.

2. What Data Is Processed

  • Browsing data: IP address, browser and device type, language, requested page, referring page and timestamps. This is generated automatically when any website is served.

  • Analytics data (only with consent): a randomised identifier stored in your browser, pages and events, session information, approximate location derived from the IP address (country/city level) and device characteristics.

  • Session recordings (only with consent): an anonymised replay of your interaction with the site (pages, clicks, scrolling). Text typed into forms and other sensitive content is masked and is not stored.

  • Contact data: your name, email address and the content of the message you send me by email.

The website does not ask you to create an account and does not process special categories of data.

Is the analytics data anonymous? In practice, yes. The identifiers used for analytics and session recording are random and pseudonymous: they are not linked to your name, your email address or any account, and this website has no registration. The information (pages, devices, interactions) is used in aggregate to improve the site, is never used to identify or contact you, and does not feed automated decisions about you. Session recordings mask everything you type. The only personal data that can identify you directly is the email address and message you send me, which I use only to answer you.

3. Purposes and Legal Bases

  • Providing the website and keeping it secure (hosting, log records, abuse prevention): legitimate interest in maintaining a secure and functional service (art. 6.1.f GDPR).

  • Measuring audiences and improving the site (analytics and session recordings): your consent (art. 6.1.a GDPR), which you can withdraw at any time.

  • Answering your messages when you write to me: performance of a request or pre-contractual relationship (art. 6.1.b GDPR) and, where applicable, your consent.

  • Complying with legal obligations: (art. 6.1.c GDPR).

4. Recipients and Processors

Personal data is not sold or shared with third parties for their own purposes. The following service providers act as data processors, under the corresponding data-processing agreements:

  • Vercel Inc. — hosting and content delivery of the website.

  • PostHog (EU Cloud) — product analytics, event tracking and session recording.

  • Google LLC (Google Analytics 4, loaded through Google Tag Manager) — audience measurement, only if you accept analytics cookies.

  • Email provider used for the info@mockup.es mailbox, only if you write to me.

5. International Data Transfers

PostHog is used in its EU Cloud region, so analytics and session-recording data are stored within the European Economic Area. Some providers (such as Vercel Inc. and Google LLC) may process data outside the EEA; in those cases the transfers are covered by the European Commission's Standard Contractual Clauses and, where applicable, by the EU-U.S. Data Privacy Framework.

6. Retention

  • Browsing and server logs: the period strictly necessary for security and troubleshooting, and in any case no longer than 12 months.

  • Analytics events: up to 1 year.

  • Session recordings: up to 30 days.

  • Consent record: up to 2 years, as evidence of your decision.

  • Emails you send me: up to 1 year after the conversation ends, unless a legal obligation requires a longer period.

7. Your Rights

You can exercise the following rights at any time by writing to info@mockup.es:

  • Access to the personal data being processed.

  • Rectification of inaccurate or incomplete data.

  • Erasure (“right to be forgotten”).

  • Restriction of processing.

  • Objection to processing based on legitimate interest.

  • Portability of the data you provided.

  • Withdrawal of consent at any time, without affecting the lawfulness of the processing carried out before the withdrawal. For analytics and session recording you can withdraw directly from the cookie settings panel in the website footer.

I will answer your request within one month. If you believe your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

8. Security

The website is served over HTTPS and applies reasonable technical and organisational measures to protect personal data: encrypted transport (HSTS), restrictive security headers, access control over the analytics dashboards, and masking of form content in session recordings. No system is completely infallible, but the data processed here is limited to what is described above.

9. Minors

The website is aimed at a professional audience and is not directed at minors under 14 years of age. If you believe a minor has provided personal data, please contact me so I can delete it.

10. Automated Decisions

No automated decisions with legal effects or profiling that significantly affects you are made with the data described in this policy.

11. Changes to This Policy

This Privacy Policy may be updated to reflect legal or functional changes. The current version will always be published on this page with its “Last updated” date. Last updated: 09/11/2026.

12. Contact